YARA

Overview

YARA is a tool for creating descriptions of malware families based on text, binary patterns, and conditions. Security researchers write YARA rules that match specific byte sequences, strings, or file characteristics to classify samples. Used in malware analysis, threat hunting, and CTF forensics.

Basic Scanning

Scan a file with a rule

yara rule.yar malware.exe

Scan a directory recursively

yara rule.yar /suspicious/files/ -r

Scan with multiple rule files

yara rules1.yar rules2.yar /target/

Scan a directory of rules against a file

yara /opt/yara-rules/*.yar malware.exe

Run with timeout (seconds)

yara rule.yar suspicious.exe --timeout=60

Scan a memory dump

yara rule.yar memory.dmp

Scan a running process (by PID)

sudo yara rule.yar 1234

YARA Rule Structure

rule ExampleMalware {
    meta:
        author = "analyst"
        description = "Detects ExampleMalware"
        date = "2024-01-01"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    
    strings:
        $str1 = "malicious_string"
        $str2 = "another_ioc"
        $hex1 = { 6A 40 68 00 30 00 00 }   // Hex pattern
        $re1  = /https?:\/\/[a-z]{8}\.com/  // Regex
    
    condition:
        uint16(0) == 0x5A4D and       // MZ header (PE file)
        filesize < 1MB and
        any of ($str*)                 // Any of the $str patterns
}

Common Conditions

// File type detection
uint16(0) == 0x5A4D        // PE (Windows executable)
uint32(0) == 0xCEFAEDFE    // Mach-O (macOS)
uint32(0) == 0x464C457F    // ELF (Linux)
uint16(0) == 0xD8FF        // JPEG
uint32(0) == 0x04034B50    // ZIP

// String matching
all of ($str*)             // All strings must match
any of ($str*)             // At least one must match
2 of ($str*)               // At least 2 must match
$str1 and $str2            // Both must match

// Counting
#str1 >= 3                 // $str1 appears 3+ times

// Offset matching
$str1 at 0                 // $str1 at offset 0
$str1 in (0..1024)         // $str1 in first 1024 bytes

// File size
filesize < 100KB
filesize in (1KB..1MB)

Using Community Rulesets

# Clone YARA rules repositories
git clone https://github.com/Yara-Rules/rules /opt/yara-rules
git clone https://github.com/Neo23x0/signature-base /opt/signature-base

Scan with entire ruleset

yara -r /opt/yara-rules/malware/ suspicious.exe 2>/dev/null

Use Loki (YARA-based IOC scanner)

python3 loki.py -p /suspicious/files/

# VirusTotal YARA (requires API key)
# Upload sample → get YARA matches against VT's ruleset

Practical Examples

// Detect Mimikatz
rule Mimikatz {
    strings:
        $s1 = "sekurlsa" nocase
        $s2 = "lsadump" nocase
        $s3 = "kerberos" nocase
        $s4 = "gentilkiwi" nocase
    condition:
        2 of them
}

// Detect Base64-encoded PowerShell
rule B64PowerShell {
    strings:
        $s1 = "powershell" nocase
        $enc = "-EncodedCommand" nocase
        $b64 = /[A-Za-z0-9+\/]{50,}={0,2}/
    condition:
        $s1 and $enc and $b64
}

// Detect suspicious PE
rule SuspiciousPE {
    condition:
        uint16(0) == 0x5A4D and
        pe.number_of_sections > 5 and
        pe.imphash() == "fcab201a53f9e5c2e9e9dc6d5b01a15a"
}

Tips

• yara -s shows matched strings with their positions — useful for analysis
• -r for recursive directory scanning; essential for hunting across many files
• Import the pe module for Windows binary-specific conditions (pe.imphash(), pe.sections)
• Test rules against known clean samples to minimize false positives

yara [options] <rules> <target>

-r             Recursively scan directories
-d VAR=VAL     Define external variable
-x MODULE=FILE Load module data from file
-t TAG         Only show rules with matching tag
-i IDENT       Only show rules with matching identifier
-n             Only show rules that don't match (inverse)
-l N           Abort scan after N matches
-s             Print matched strings
-f             Fast mode (skip strings after first match)
--timeout=N    Abort after N seconds
-p N           Use N threads
-m             Print metadata in output
-e             Print module data

Vue d’ensemble

YARA est un outil pour créer des descriptions de familles de malware basées sur du texte, des motifs binaires, et des conditions. Les chercheurs en sécurité écrivent des règles YARA qui correspondent à des séquences d’octets, chaînes, ou caractéristiques de fichiers spécifiques pour classifier des échantillons. Utilisé en analyse de malware, threat hunting, et forensique CTF.

Scan de base

# Scanner un fichier avec une règle
yara rule.yar malware.exe

# Scanner un répertoire récursivement
yara rule.yar /suspicious/files/ -r

# Scanner avec plusieurs fichiers de règles
yara rules1.yar rules2.yar /target/

# Scanner un répertoire de règles contre un fichier
yara /opt/yara-rules/*.yar malware.exe

# Lancer avec un timeout (secondes)
yara rule.yar suspicious.exe --timeout=60

# Scanner un dump mémoire
yara rule.yar memory.dmp

# Scanner un processus en cours d'exécution (par PID)
sudo yara rule.yar 1234

Structure d’une règle YARA

rule ExampleMalware {
    meta:
        author = "analyst"
        description = "Detects ExampleMalware"
        date = "2024-01-01"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    
    strings:
        $str1 = "malicious_string"
        $str2 = "another_ioc"
        $hex1 = { 6A 40 68 00 30 00 00 }   // Motif hexadécimal
        $re1  = /https?:\/\/[a-z]{8}\.com/  // Regex
    
    condition:
        uint16(0) == 0x5A4D and       // En-tête MZ (fichier PE)
        filesize < 1MB and
        any of ($str*)                 // N'importe lequel des motifs $str
}

Conditions courantes

// Détection du type de fichier
uint16(0) == 0x5A4D        // PE (exécutable Windows)
uint32(0) == 0xCEFAEDFE    // Mach-O (macOS)
uint32(0) == 0x464C457F    // ELF (Linux)
uint16(0) == 0xD8FF        // JPEG
uint32(0) == 0x04034B50    // ZIP

// Correspondance de chaînes
all of ($str*)             // Toutes les chaînes doivent correspondre
any of ($str*)              // Au moins une doit correspondre
2 of ($str*)                // Au moins 2 doivent correspondre
$str1 and $str2              // Les deux doivent correspondre

// Comptage
#str1 >= 3                 // $str1 apparaît 3 fois ou plus

// Correspondance de décalage
$str1 at 0                 // $str1 au décalage 0
$str1 in (0..1024)         // $str1 dans les 1024 premiers octets

// Taille du fichier
filesize < 100KB
filesize in (1KB..1MB)

Utiliser des jeux de règles communautaires

# Cloner des dépôts de règles YARA
git clone https://github.com/Yara-Rules/rules /opt/yara-rules
git clone https://github.com/Neo23x0/signature-base /opt/signature-base

# Scanner avec le jeu de règles entier
yara -r /opt/yara-rules/malware/ suspicious.exe 2>/dev/null

# Utiliser Loki (scanner d'IOC basé sur YARA)
python3 loki.py -p /suspicious/files/

# VirusTotal YARA (nécessite une clé API)
# Téléverser un échantillon → obtenir les correspondances YARA avec le
# jeu de règles de VT

Exemples pratiques

// Détecter Mimikatz
rule Mimikatz {
    strings:
        $s1 = "sekurlsa" nocase
        $s2 = "lsadump" nocase
        $s3 = "kerberos" nocase
        $s4 = "gentilkiwi" nocase
    condition:
        2 of them
}

// Détecter un PowerShell encodé en Base64
rule B64PowerShell {
    strings:
        $s1 = "powershell" nocase
        $enc = "-EncodedCommand" nocase
        $b64 = /[A-Za-z0-9+\/]{50,}={0,2}/
    condition:
        $s1 and $enc and $b64
}

// Détecter un PE suspect
rule SuspiciousPE {
    condition:
        uint16(0) == 0x5A4D and
        pe.number_of_sections > 5 and
        pe.imphash() == "fcab201a53f9e5c2e9e9dc6d5b01a15a"
}

Conseils

• yara -s affiche les chaînes correspondantes avec leurs positions : utile pour l’analyse
• -r pour le scan récursif de répertoires ; essentiel pour la chasse à travers de nombreux fichiers
• Importer le module pe pour les conditions spécifiques aux binaires Windows (pe.imphash(), pe.sections)
• Tester les règles contre des échantillons sains connus pour minimiser les faux positifs

yara [options] <rules> <target>

-r             Recursively scan directories
-d VAR=VAL     Define external variable
-x MODULE=FILE Load module data from file
-t TAG         Only show rules with matching tag
-i IDENT       Only show rules with matching identifier
-n             Only show rules that don't match (inverse)
-l N           Abort scan after N matches
-s             Print matched strings
-f             Fast mode (skip strings after first match)
--timeout=N    Abort after N seconds
-p N           Use N threads
-m             Print metadata in output
-e             Print module data